CVE-2018-5743: By design, BIND is intended to limit the number of TCP clients that can be connected at any given time

High severity · published Oct 9, 2019

CVE-2018-5743

By design, BIND is intended to limit the number of TCP clients that can be connected at any given time

7.5

CVSS

6.5%

EPSS

On KEV

Description

By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contained an error which could be exploited to grow the number of simultaneous connections beyond this limit. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5743.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)6.5% · higher than 94% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Big-ip Access Policy Manager · F5

11.5.2 through 11.6.5; 12.1.0 through 12.1.4; 13.1.0 through 13.1.1; 14.0.0 through 14.1.0; 15.0.0 · source: NVD

Big-ip Advanced Firewall Manager · F5

11.5.2 through 11.6.5; 12.1.0 through 12.1.4; 13.1.0 through 13.1.1; 14.0.0 through 14.1.0; 15.0.0 · source: NVD

Big-ip Analytics · F5